Forum Discussion

zeropixel_23561's avatar
zeropixel_23561
Icon for Nimbostratus rankNimbostratus
Feb 02, 2016

Bypass F5 ASM

Has anyone attempted to bypass F5 ASM?

 

I tried the built-in features in nmap, sqlmap, and WAFW00F but unable to detect and bypass F5 ASM. I don't know if I did it right. I also found this article https://packetstormsecurity.com/files/131781/F5-BIG-IP-ASM-11.4.1-Filter-Bypass.html by adding "Content-Type: application/json" but it is also not helping.

 

I wonder if anyone has experiences to bypass F5 ASM? If you do, please share the approach and I do appreciate it.

 

Thanks!!

 

ASM Advanced WAF
security
waf

1 Reply

Sort By
  • Chris_Grant's avatar
    Chris_Grant
    Icon for Employee rankEmployee
    Feb 02, 2016

    If the ASM is properly configured, you should not be able to bypass it. If you can bypass it this would be considered either a misconfiguration or a defect.

     

    The URL you reference is well known to me and requires a very specific configuration on the ASM. You would need to have the ASM configured to handle both JSON and form encoded data on the same URL (a highly specialized and unusual configuration to say the least). For most users this would be a misconfiguration, as a web application would normally either process JSON or form encoded data, possibly both on different URLs, but not likely both on the same URL.

     

    If you are the administrator of the ASM it is fairly trivial to configure the BigIP to bypass the ASM for specific requests using Local Traffic Policies or iRules. As an end user this should not be possible.